[Samba] smbcacls got error NT_STATUS_NETWORK_NAME_DELETED

[Andy Qian]

Thank you very much for the reply.

I will file a bug for this.


Best

Andy


On 06/08/2017 09:37 AM, Jeremy Allison wrote:
> On Thu, Jun 08, 2017 at 09:23:50AM -0700, Andy Qian via samba wrote:
>> Hi, all,
>>
>> we run smbcacls tool from linux machine to set file permissions on
>> windows server.
>>
>> here is our environment:
>>
>>
>> Linux machine:  Ubuntu 14.04 LTS, kernel version 3.13.0-112-generic
>>
>> Samba version: 4.3.11
>>
>> Windows machine: Windows server 2012
>>
>>
>> the cmd we run is something like following:
>>
>> /usr/bin/smbcacls -U 'Domain\Administrator'%'pwd'
>> '//win_server/testshare' 'TestFolder\Test.txt' -S 'REVISION:1','ACL:win_server\Administrator:DENIED/0/0x100116','ACL:win_server\Administrator:ALLOWED/0/0x1200a9','ACL:Domain\Administrator:ALLOWED/16/FULL'
>>
>> The smbcacls cmd worked before till recently. Due to the recent
>> Windows patch which disables SMB v1, we have to add the following
>> line into the [global] section in smb.conf file on Linux machine so
>> that the smbcacls can talk to the Windows server otherwise it gets
>> error NT_STATUS_CONNECTION_RESET:
>>
>> client max protocol = SMB3
>>
>> with this option added, the smbcacls cmd ran into error
>> NT_STATUS_NETWORK_NAME_DELETED.
>>
>> but if we just run smbcacls cmd to get ACLs, like
>>
>> /usr/bin/smbcacls -U 'Domain\Administrator'%'pwd'
>> '//win_server/testshare' 'TestFolder\Test.txt'
>>
>> it works without any problem, and does return all ACL entries.
>>
>>
>> if we remove this "client max protocol == SMB3" option from smb.conf
>> file and turn on the SMBv1 on Windows server side, the exactly same
>> smbcacls cmd for setting permission works as before.
>>
>>
>> I have spent many hours googling and reading documents, but could
>> not find anything related or helpful. Any suggestion or comment will
>> be extremely helpful!
> Can you log a bug so we can track this, and then upload
> a debug level 10 log from the client smbcacls command
> failing so we can take a look ?
>
> Thanks,
>
> Jeremy.